Privacy Policy

Abel Consulting Group ("ACG," "we," "us," or "our") respects the privacy of our clients, prospective clients, and website visitors. This Privacy Policy describes the information we collect, how we use it, when it may be shared, and the choices available to you.

1. Information We Collect

We may collect information that you provide directly to us, including:

• Your name, email address, telephone number, company, and professional contact information.
• Information submitted through our website contact forms.
• Information provided when scheduling a consultation or communicating with ACG.
• Information, documents, or materials you voluntarily provide in connection with a consultation or professional engagement.
• Billing and transaction information associated with services purchased from ACG.

We may also collect limited technical information associated with use of our website, such as browser type, device information, IP address, referring pages, and website usage information through our hosting, security, or analytics providers.

2. How We Use Information

We use information collected through the website and our services to:

• Respond to inquiries and communicate with clients and prospective clients.
• Schedule and provide consultations and professional services.
• Process payments and maintain transaction records.
• Prepare for and perform requested professional engagements.
• Operate, maintain, secure, and improve our website and services.
• Prevent fraud, misuse, and security incidents.
• Maintain business, accounting, tax, and compliance records.
• Comply with applicable laws, regulations, legal processes, and professional obligations.

ACG does not sell personal information.

3. Scheduling and Payment Providers

ACG uses third-party service providers to support certain business functions.

Scheduling may be provided through Cal.com. Information you submit when scheduling an appointment may therefore be processed by Cal.com in accordance with its own privacy practices.

Payment processing is provided through Stripe. Payment card information is submitted to and processed by Stripe. ACG does not directly store your complete payment card number through its website.

Other service providers may support website hosting, email, communications, analytics, security, and other business operations. These providers may process information as necessary to perform services on our behalf.

4. Information and Documents Provided for Professional Services

Some ACG services may require clients to provide business records, financial information, banking information, identity documents, images, or other materials necessary to perform the requested service.

ACG uses such materials for the purpose of providing the requested service and related business administration. We seek to limit collection to information reasonably necessary for the engagement.

Clients should not provide passwords, authentication codes, private cryptographic keys, or other account credentials unless ACG has specifically established an appropriate method and need for doing so.

5. Identity Documents and Signature Specimen Services

Certain services, including signature specimen extraction, may involve client-provided images of identification documents.

Such materials are provided solely for purposes related to the requested service and are treated as sensitive client materials. ACG does not sell identity-document information or use submitted identity documents for advertising purposes.

Clients submitting identity documents or documents belonging to another individual represent that they are authorized to provide those materials to ACG for the requested purpose.

6. ACG Client Portal

ACG offers an online client portal that helps business clients maintain records of the legal entities they own or work with. This section describes information handled through the portal in addition to the rest of this policy.

• Account information. You sign in to the portal with a Google account. We receive your name, email address, and account identifier from Google, and we maintain your organization, role, and permissions within the portal. Contact details you choose to provide, such as a phone number, are used to personalize your account settings, like your time zone, and to secure your account, for example through two-step verification by text message. You can ask us to remove a phone number you have provided by contacting us as described below.
• Activity records. We keep records of actions taken in the portal, such as changes to entity records and approvals of those changes, for security, audit, and dispute-resolution purposes.
• Entity records and documents. We store the entity information and documents that you and your organization add to the portal.
• Documents that name other people. An organization may upload documents that name individuals who are not portal users, for example a beneficial ownership certification (which can list owners and a control person with their date of birth, address and a government identification number) or a resolution or incumbency certificate naming officers and authorized signers. The organization is the party with the relationship to those individuals and is responsible for having told them that the document is stored here. We hold such a document on the organization's instructions: we store it as provided, we do not read, extract, display or use its contents, and we do not send it to anyone through the portal's secure links. It can be opened only by members of the organization who hold the relevant document permission, after two-step verification; other members can see that the document exists, its type and date, and, for a document that was uploaded first and assigned to this purpose later, the name it was uploaded under. The organization can replace or delete the document at any time, which is also how a named individual's request to remove their information is met.
• Invitations and notifications. We send portal invitations and notifications by email through an email service provider.
• Feedback. We store feedback and problem reports you submit through the portal. If you choose to attach a screenshot or screen recording, we store it too; it may show anything that was on your screen, so please avoid capturing information you do not want to share. Reports may also be recorded in our issue-tracking system.
• Bank account connections. If you choose to connect a bank account, the connection is provided by Plaid Inc. Information you provide to Plaid is governed by Plaid's End User Privacy Policy, and ACG receives account and transaction information that you authorize Plaid to share. We use it only to provide the portal's services to your organization, such as account history and cash-flow forecasting. Disconnecting a bank account, or revoking access through Plaid, stops new information from being collected. Information already received is kept, so your history and forecasts stay available, until you ask us to delete it or your organization closes its account. If you withdraw access through your bank's own website and your bank notifies us of that through Plaid, we delete that account's transaction data.
• Documents shared with your bank or another recipient. A portal user with the right permission can share an entity's documents with a named person outside the portal, such as a banker, through a link that opens only with a one-time code sent to that person's email address. For each share we keep the recipient's email address, when the share was created and when it expires (the sender chooses, between 1 and 30 days), and a security log of each opening: the browser type (for example "Chrome on Mac"), the approximate country or region of the connection, and, if the recipient agreed to it on the opening screen, a random tag stored in their browser that tells a first opening from one in a new browser. We do not store the recipient's IP address or precise location; to limit repeated attempts, a one-way hash of the connecting address is kept for a short time (up to about a day after its last use) and then deleted. The log exists so the sender can see whether a link has been forwarded; it is shown only to the sending organization, is not used for marketing, and is not sold or shared. The approximate region is derived with IP geolocation data from DB-IP, used under the Creative Commons Attribution 4.0 licence; no information about the recipient is sent to DB-IP. Recipients may contact us as described below to ask what we hold or to have it deleted.

7. Public Business Registry Information

When a portal user searches for or adds a business entity, the portal retrieves information about that entity from public government business registries and from business-information providers. Current sources are U.S. state business filing records (obtained through Cobalt Intelligence) and, for companies registered in the United Kingdom, Companies House. We may add or remove sources and will update this policy when we do. Information already obtained from a source we no longer use is kept under the retention terms in this policy.

These public records include information about individuals connected with a business. Those individuals are usually not users of the portal. If you are one of them, this part of the policy is written for you.

• What we obtain. From U.S. state records: the names and roles of officers and directors, and the names and addresses of registered agents, as published by the state. From Companies House: for directors and other officers, name, role, and appointment and resignation dates; for people with significant control (PSCs), name, the nature of their control, the dates it was notified and ceased, nationality and country of residence. We never collect or store a person's day of birth or home address from any register, even where a register publishes them, and we do not combine register entries into profiles of a person across companies.
• Source and attribution. The information comes from the public registry or provider named above, as published by that source. Companies House information is used under the Open Government Licence v3.0 and is marked as such where it is shown. The portal shows a link to the register entry for anyone who needs details we do not hold.
• Purpose. We use it so that our business clients, and the banks and other institutions they deal with, can identify, verify, and keep accurate records of legal entities (entity due diligence and know-your-customer checks). We do not use it for marketing, to make decisions about anyone's eligibility for credit, insurance, employment, or housing, and we do not sell it.
• Legal basis. Where UK or EU data protection law applies, we rely on legitimate interests: our clients' interest, and ours, in verifying the businesses they own or deal with, and the public interest in accurate checks on who runs and controls a company, using information that the law requires to be public.
• Reuse of search results. Because these results reflect public records, information retrieved for one portal user may be stored and reused to answer later searches by other portal users. We refresh a stored register extract from its source whenever it is viewed and is more than 30 days old (officers and PSCs) or more than 90 days old (other entity details), and we replace it with what the register currently shows, so anyone the register no longer lists disappears from our copy at the next refresh. Results recording a business as dissolved or inactive are not automatically refreshed.
• How long we keep it. Two periods apply. A stored register extract is deleted two years after it was last viewed by any portal user. A copy of register information that forms part of a client's completed due-diligence record (for example a report or a package the client shared with its bank) is kept for five years after that client relationship ends, and never more than ten years from when it was created, because banks must keep their own due-diligence records for that long. We delete a stored extract sooner if the register withdraws or protects the entry, or if we uphold an objection from the person concerned.
• Your rights. You may ask us what we hold about you, ask for correction or deletion, or object to our use of it, as described in the "Your Choices and Privacy Requests" section below. If we uphold an objection, we stop showing you in the portal and keep only a record of that decision so you are not shown again. We cannot change the public register itself; information that is wrong there must also be corrected at the source.
• Where it is stored. In the United States, as described in the "Where Information Is Stored" section.

8. Where Information Is Stored

The portal's web pages are served by Netlify. Its database and application servers run on Google Cloud in the United States. Portal information is also processed by the service providers described in this policy, such as Netlify, our email provider, issue-tracking provider, Plaid, and the business-information sources above. If you are located outside the United States, including in the United Kingdom or European Economic Area, your information will be transferred to and processed in the United States. Where UK or EU law requires safeguards for such transfers, we rely on the transfer mechanisms provided in our service providers' data processing terms.

9. Information Sharing

ACG may disclose information:

• To service providers performing functions on our behalf.
• When necessary to provide a service requested by you.
• To professional advisers such as attorneys, accountants, insurers, or auditors when reasonably necessary.
• To comply with applicable law, regulation, subpoena, court order, or other legal process.
• To protect the rights, property, security, or safety of ACG, our clients, or others.
• In connection with a merger, acquisition, financing, reorganization, or sale of all or part of the business.

We do not sell client or website-visitor personal information.

10. Data Retention

ACG retains personal information and engagement materials only for as long as reasonably necessary for the purposes for which they were collected, legitimate business and recordkeeping needs, dispute resolution, security, and applicable legal or regulatory requirements.

Retention periods may vary depending on the nature of the information and the service provided.

For the ACG client portal:

• Account and organization information is kept while the account is active and deleted within 30 days after the organization closes its account or after we verify a deletion request.
• Bank account and transaction information is kept as described in the "ACG Client Portal" section above, until you ask us to delete it or your organization closes its account.
• Security and audit records, such as records of changes and approvals, including the name and email address of the person who made them, are kept for up to seven years, including after an account closes, for security, compliance, and dispute-resolution purposes.
• Other operational records, such as unaccepted invitations, delivery logs, and feedback reports, are deleted on request, and are being moved to automatic deletion after limited periods.
• Public register information about officers, directors, and people with significant control is kept as described in the "Public Business Registry Information" section: a stored extract is deleted two years after it was last viewed, and a copy inside a client's completed due-diligence record is kept for five years after that client relationship ends, up to ten years from its creation.
• A record that we have upheld a person's objection (identifiers only, no name) is kept for as long as needed to honour it.
• Documents that name other people are kept until the organization replaces or deletes them or closes its account. A packaged copy made for an administrator's download is deleted within one day.
• Share-link records (recipient email, opening log) are deleted 90 days after the share expires or is revoked, whichever is earlier; the shared documents themselves are removed from the share when it ends.
• Backups, where kept, are retained for a limited period, so deleted information may remain in backups until they expire.

We respond to verified deletion requests within 30 days, except where we must keep information to meet a legal obligation.

11. Data Security

ACG uses reasonable administrative, technical, and organizational measures intended to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

No electronic transmission or storage system can be guaranteed to be completely secure. Clients should use appropriate care when transmitting confidential or sensitive information electronically.

12. Cookies and Similar Technologies

The ACG website and its service providers may use cookies or similar technologies necessary to operate, secure, understand, and improve the website.

Third-party services linked from or embedded within the website may maintain their own cookies and privacy practices.

13. Your Choices and Privacy Requests

You may contact ACG to ask about personal information we maintain about you or to request correction or deletion of information, subject to applicable legal, contractual, security, and recordkeeping requirements.

Privacy requests may be sent to:
max@abelconsultinggroup.com

We may take reasonable steps to verify the identity and authority of a person making a request before providing, changing, or deleting information.

If you are in the United Kingdom or European Economic Area, you have rights under applicable data protection law, including the right to access, correct, or erase your personal information, to restrict or object to its processing, and to data portability where applicable. You also have the right to lodge a complaint with your data protection authority, which in the United Kingdom is the Information Commissioner's Office (ico.org.uk).

If you are named in a document an organization uploaded and want it corrected or removed, contact that organization, which holds the relationship with you; you may also contact us and we will pass the request to the organization and confirm when it has acted.

14. Third-Party Websites and Services

Our website may link to third-party websites or services. ACG is not responsible for the privacy, security, or content practices of third parties. Your use of those services is governed by their respective policies and terms.

15. Changes to This Policy

We may update this Privacy Policy as our services, technology, or legal obligations change. The current version will be posted on this website with its effective date.

16. Contact

Questions about this Privacy Policy or ACG's privacy practices may be directed to:

Abel Consulting Group
max@abelconsultinggroup.com